<br><br><div class="gmail_quote">On Wed, Jun 22, 2011 at 12:56 PM, Brian Wood <span dir="ltr"><<a href="mailto:woodbrian77@gmail.com">woodbrian77@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Robert Nesius:<br>
> My one thought is to check syslogd.conf (usually in /etc) and make sure<br>
> syslogd is configured to log the messages your program is sending. If not<br>
> configured properly, syslogd will drop them.<br>
<br clear="all">I don't have an /etc/syslogd.conf or /etc/syslog.conf. I read somewhere<br>that they changed the name of /etc/syslog.conf to /etc/rsyslog.conf and<br>I do have that file. I sent a copy of that file to the user and asked<br>
him to compare it to his copy -- although I'm not sure if he has that<br>file on his machine. He checked yesterday though on his machine<br>and he didn't have /etc/syslog.conf file either. My guess is this is<br>
on the right track, but have no idea how the default configurations <br>differ between the distributions.<br><br></blockquote><div><br>Oh - looks like old-school syslog has been replaced by something modular. <br><br>I see this at the bottom of my /etc/rsyslog.conf file: <br>
<br><span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"># Include all config files in /etc/rsyslog.d/</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">$IncludeConfig /etc/rsyslog.d/*.conf</span><br style="font-family: courier new,monospace;">
<br>Here is an excerpt of what /etc/rsyslog.d/50-default.conf has. <br><br style="font-family: comic sans ms,sans-serif;"><span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"># First some standard log files. Log by facility.</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">auth,authpriv.* /var/log/auth.log</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">*.*;auth,authpriv.none -/var/log/syslog</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">#cron.* /var/log/cron.log</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">daemon.* -/var/log/daemon.log</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">kern.* -/var/log/kern.log</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">lpr.* -/var/log/lpr.log</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">mail.* -/var/log/mail.log</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">user.* -/var/log/user.log</span><br style="font-family: courier new,monospace;">
<br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"># Logging for the mail system. Split it up so that</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"># it is easy to write scripts to parse these files.</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">#</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"><a href="http://mail.info">mail.info</a> -/var/log/<a href="http://mail.info">mail.info</a></span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">mail.warn -/var/log/mail.warn</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">mail.err /var/log/mail.err</span><br><br>Bottom line, if the tool is logging to syslog, you need to configure both sides such that: <br>a: The sender is sending messages to the correct machine<br>
b: The receiver is configured to log the messages. <br><br>I think anything that doesn't match a rule gets dropped silently. Also, I think syslog often (always?) logs via UDP packets, not TCP. <br><br>-Rob <br></div>
</div>